Solution to Keep the US Government from Snooping

Solution to Keep the US Government from Snooping

In light of continuing news reports of the U.S. government snooping on email and related communications insecurities, Dave Anderson, senior director at Voltage Security offers an engaging commentary. He highlights the value of Solution to Keep the US Government from Snoopingencryption, where the intended email recipient, who is validated, is the one to decrypt the email’s data in order to read it. According to Anderson, the ultimate solution is a stateless key management encryption solution that generates crypto keys on demand, and only when encryption and decryption is needed.

“Email is such a ubiquitous form of communication in business today, not just for simple status communications to employees, but also to distribute content and information outside of the organization to customers, partners and suppliers. Most companies are using email to send sensitive information, including financial, HR, health care and other personally identifiable information, often times without realizing the ease of this information being exposed and lost unless the email and attachments are encrypted. 

“Email can be made private and not subject to exposure or snooping, if the proper encryption methods are implemented to protect the email and all attachments end-to-end, all the way through to the intended recipient. Identity-based encryption, which employs a user’s identity as part of the algorithm to generate the encryption keys on-demand, can effectively encrypt and secure email content and corresponding attachments, both structured and unstructured data, and can maintain that level of encryption from the moment it is created until it is decrypted and read by the intended recipient.

“Many of the surveillance programs in the recent news have employed a process not where they are breaking the crypto, but simply sniffing the email and payload content either before it has been encrypted or after it has been decrypted before it’s sent to the recipient. Gateway solutions are common in these scenarios where the sniffing happens at the gateway, once the gateway receives a clear text email but before the gateway encrypts, or alternatively once the recipient’s gateway receives the encrypted email and then decrypts, but before it gets sent to the recipient.  

“Email security has been available since the dot-com era began as PKI programs provided encryption solutions that could be integrated and used within common email systems.  However, these PKI-based solutions were very difficult to properly deploy. They were very manual in nature and therefore, not user friendly, and often the integration with email systems was difficult and not seamless.  Many companies did not deploy email encryption at this time simply because of these issues, although continued to use email to communicate sensitive information, assuming that other security controls, such as user access and authorization, VPN, or DLP solutions, would keep their email secure, which obviously hasn’t been the case.

“PGP, and other PKI-based encryption solutions, force the customer to adopt a manual, difficult process for generating and managing the crypto keys and certificates used to encrypt, decrypt, and validate users. The key management behind these systems is very difficult for the average enterprise to adopt, and is quite costly over the long run, as the management processes for these systems require a great deal of manual activity and oversight. A better alternative is a stateless key management encryption solution, where crypto keys are generated on demand, only when the user needs to encrypt and decrypt.  Stateless key management, combined with an identity-based encryption solution, completely removes the complexity, cost, and management overhead from an email encryption solution, and can be rapidly adopted and integrated into an enterprise.”

About the Author

Dave Anderson is senior director at Voltage Security.

Featured

  • Cybersecurity Awareness Month: Top Five Action Items to Elevate Your Data Security Posture Management and Secure Your Data

    October is Cybersecurity Awareness Month, and every year most tips for security hygiene and staying safe have not changed. We’ve seen them all – use strong passwords, deploy multi-factor authentication (MFA), be vigilant to spot phishing attacks, regularly update software and patch your systems. These are great recommended ongoing tips and are as relevant today as they’ve ever been. But times have changed and these best practices can no longer be the bare minimum. Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3